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Abstract. It is shown that for cuckoo hashing with a stash as proposed 
by Kirsch, Mitzenmacher, and Wieder (2008) families of very simple hash 
functions can be used, maintaining the favorable performance guarantees: 
with stash size s the probability of a rehash is 0{l/n"'^^), and the evalu- 
ation time is 0(s). Instead of the full randomness needed for the analysis 
of Kirsch et al. and of Kutzelnigg (2010) (resp. 0(log n)-wise indepen- 
dence for standard cuckoo hashing) the new approach even works with 
2-wise independent hash families as building blocks. Both construction 
and analysis build upon the work of Dietzfelbinger and Woelfel (2003). 
The analysis, which can also be applied to the fully random case, utilizes 
a graph counting argument and is much simpler than previous proofs. 
As a byproduct, an algorithm for simulating uniform hashing is obtained. 
While it requires about twice as much space as the most space efficient 
solutions, it is attractive because of its simple and direct structure. 



1 Introduction 

Cuckoo hashing as proposed by Pagh and Rodler is a popular implementa- 
tion of a dictionary with guaranteed constant lookup time. To store a set S of 
n keys from a universe U (i.e., a finite set), cuckoo hashing utilizes two hash 
functions, hi,h2 '■ U ^ [m], where m = (1 -\-e)n, e > 0. Each key x e S* is stored 
in one of two hash tables of size m; either in the first table at location hi{x) 
or in the second one at location h2{x). The pair /ii, /12 might not be suitable to 
accommodate S in these two tables. In this rehash operation is necessary, 

which chooses a new pair hi, /12 and inserts all keys anew. 

In their ESA 2008 paper [11], Kirsch, Mitzenmacher, and Wieder deplored 
the order of magnitude of the probability of a rehash, which is as large as 0(l/n) . 
They proposed adding a stash, an additional segment of storage that can hold 
up to s keys for some (constant) parameter s, and showed that this change 
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reduces the rehash probabihty to 9(l/n'*+^). However, the analysis of Kirsch et 
al. requires the hash functions to be fully random. In the journal version [T^] 
Kirsch et al. posed "proving the above bounds for explicit hash families that can 
be represented, sampled, and evaluated efficiently" as an open problem. 

Our contribution. In this paper we generalize a hash family construction 
proposed by Dietzfelbinger and Woelfel [9 and show that the resulting hash 
functions have random properties strong enough to preserve the qualities of 
cuckoo hashing with a stash. The proof involves a new and simpler analysis 
of this hashing scheme, which also works in the fully random case. The hash 
functions we propose have a very simple structure: they combine functions from 
0(l)-wise independent familie^ with a few tables of size with random 

entries from [m] — {0, . . . , m — 1}. An attractive version of the construction for 
stash capacity s has the following performance characteristics: the description of 
a hash function pair (/ii,/i2) consists of a table with ^/n entries from [to]^ and 
2s + 6 functions from 2-wise independent classes. To evaluate hi{x) and h2{x) 
for X G U, we must evaluate these 2s + 6 functions, read 2s + 4 table entries, 
and carry out 4s + 8 additions modulo m. Our main result implies for these hash 
functions and for any set S C U oi n keys that with probability 1 — 0(l/n*+-'^) 
S can be accommodated according to the cuckoo hashing rules. 

In addition, we present a simple data structure for simulating a uniform hash 
function on S with range i?, using our hash class and essentially a table with 
2(1 + e)n random elements from R. 

Cuckoo hashing with a stash and weak hash functions. In [12ll4j it 

was noticed that for the analysis of cuckoo hashing with a stash of size s the 
properties of the so-called cuckoo graph G{S, hi, /12) are central. Assume a set S 
and hash functions hi and h2 with range [m] are given. The associated cuckoo 
graph G{S,hi,h2) is the bipartite multigraph whose two node sets are copies 
of [to] and whose edge set contains the n pairs {hi{x),h2{x)), for x & S.lt is 
known that a single parameter of G = G{S, hi, ^,2) determines whether a stash 
of size s is sufficient to store S using {hi, /12), namely the excess ex(G), which is 
defined as the minimum number of edges one has to remove from G so that all 
connected components of the remaining graph are acyclic or unicyclic. 

Lemma 1 ([12j). The keys from S can be stored in the two tables and a stash 
of size s using {hi, ^,2) */ o,nd only if ex(G(S', hi, ^,2)) < s- 

For the convenience of the reader, a proof is given in Appendix lAl along with a 
discussion of insertion procedures, which is omitted in the main text. 

Kirsch et al. [12] showed that with probability 1 — 0(1/^"+^) a random 
bipartite graph with 2to = 2{l+e)n nodes and n edges has excess at most s. Their 
proof uses sophisticated tools such as Poissonization and Markov chain coupling. 
This result generalizes the analysis of standard cuckoo hashing [17j with no stash, 
in which the rehash probability is &{l/n). Kutzelnigg [14] refined the analysis 

^ K-wise independent families of hash functions are defined in Section [2l 
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of [12] in order to determine the constant factor in the asymptotic bound of the 
rehash probabihty. His proof uses generating functions and differential recurrence 
equations. Both approaches inherently require that the hash functions hi and 
used in the algorithm are fully random. 

Recently, Patra§cu and Thorup [18 showed that simple tabulation hash func- 
tions are sufficient for running cuckoo hashing, with a rehash probability of 
Q{l/n^^^), which is tight. Unfortunately, for these hash functions the rehash 
probability cannot be improved by using a stash. 

Our main contribution is a new analysis that shows that explicit and ef- 
ficient hash families are sufficient to obtain the 0(l/n*+^) bound on the re- 
hash probability. We build upon the work of Dietzfelbinger and Woelfel [9] . For 
standard cuckoo hashing, they proposed hash functions of the form hi{x) ~ 
{fi{x) + z*-*-* mod m, for x £ U, for i £ {1, 2}, where fi and g are from 2k- 

wise independent classes with range [m] and [£], resp., and z^^\z^'^'' € [mY are 
random vectors. They showed that with such hash functions the rehash prob- 
ability is 0{l/n + n Their proof has parts (i) and (ii). Part (i) already 
appeared in |3] and [T7]: The rehash probability is bounded by the sum, taken 
over all minimal excess-1 graphs H of different sizes and all subsets T of S, of 
the probability that G{T, hi, /12) is isomorphic to H. In Sect. [S] of this paper we 
demonstrate that for hi and /12 fully random a similar counting approach also 
works for minimal excess-(s -|- 1) graphs, whose presence in G(S', /ii, /12) deter- 
mines whether a rehash is needed when a stash of size s is used. As in [T7j , this 
analysis also works for 0{{s + 1) logn)-wise independent families. 

Part (ii) of the analysis in [S] is a little more subtle. It shows that for each key 
set S of size n there is a part B™"" of the probability space given by {hi, /12) such 
that Pr(B|?"") = 0{n/t) and in 'Bf^ the hash functions act fully randomly 
on T C as long as G{T,hi,h2) is connected. In Sect. |4] we show how this 
argument can be adapted to the situation with a stash, using subgraphs without 
leaves in place of the connected subgraphs. Woelfel [23] already demonstrated 
by applying functions in [S] to balanced allocation that the approach has more 
general potential to it. 

A comment on the "full randomness assumption" and work relating to it 
seems in order. It is often quoted as an empirical observation that weaker hash 
functions like K-wise independent families will behave almost like random func- 
tions. Mitzenmacher and Vadhan [15] showed that if the key set S has a certain 
kind of entropy then 2-wise independent hash functions will behave similar to 
fully random ones. However, as demonstrated in [7], there are situations where 
cuckoo hashing fails for a standard 2-wise independent family and even a random 
set S (which is "too dense" in U). The rather general "split-and-share" approach 
of [^ makes it possible to justify the full randomness assumption for many situa- 
tions involving hash functions, including cuckoo hashing and many of its variants. 
However, for practical application this method is less attractive, since space con- 
sumption and failure probability are negatively affected by splitting the key set 
into "chunks" and treating these separately. 
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Simulating Uniform Hashing. Consider a universe U of keys and a finite 
set R. By tlie term ^^simulating uniform hashing for U and i?" we mean an 
algorithm that does the following. On input n G N, a randomized procedure sets 
up a data structure DS„ that represents a hash function h: U ^ R, which can 
then be evaluated efficiently for keys in U. For each set 5 C [/ of cardinality n 
there is an event Bg with the property that conditioned on Bg the values h{x), 
X d S, are fully random. The quality of the algorithm is determined by the space 
needed for DS„, the evaluation time for h, and the probability of the event Bg. 
It should be possible to evaluate h in constant time. The amount of entropy 
required for such an algorithm implies that at least nlog |-R| bits are needed to 
represent DS„. 

Pagh and Pagh 116' proposed a construction with 0{n) random words from 
R, based on Siegel's functions jl9j, which have constant, but huge evaluation 
time. They also gave a general method to reduce the space to (1 + e)n, at the 
cost of an evaluation time of 0(l/£^). In [9| a linear-space construction with ta- 
bles of size 0(n) was given that contain (descriptions of) 0(l)-wise independent 
hash functions. The construction with the currently asymptotically best perfor- 
mance parameters, (1 -I- e)n words from R and evaluation time 0(log(l/£)), as 
given in [6] , is based on results of Calkin [1^ and the "split-and-share" approach, 
involving the same disadvantages as mentioned above. 

Our construction, to be described in Sect. [51 essentially results from the 
construction in 16 by replacing Siegel's functions with functions from our new 
class. The data structure consists of a hash function pair (hi, from our hash 
class, a 0(l)-wise independent hash function with range R, 0{s) small tables 
with entries from R, and two tables of size m — (I + e)n each, filled with 
random elements from R. The evaluation time of h is 0{s), and for S C U, 
\S\ = n, the event Bg occurs with probability ©(l/n""*"^). The construction 
requires roughly twice as much space as the most space-efficient solutions 6 16j. 
However, it seems to be a good compromise combining simplicity with moderate 
space consumption. 

2 Basics 

Let U (the "universe") be a finite set. A mapping from U to [r] is a hash 
function with range [r]. For an integer k > 2, a set H of hash functions with 
range [r] is called a K-wise independent hash family if for arbitrary distinct 
keys Xi, . . . ,Xk G U and for arbitrary ji, . . . ^Jk G H we have Pr;ig-^(/i(xi) = 
ji A . . . A h{xK.) = Jk) = 1/r'^. The classical K-wise independent hash family 
construction is based on polynomials of degree k — 1 over a finite field [12] . More 
efficient hash function evaluation can be achieved with tabulation-based con- 
structions [912012111^] . Throughout this paper, HJ? denotes an arbitrary K-wise 
independent hash family with domain U and range [r\. 

We combine K-wise independent classes with lookups in tables of size t in 
order to obtain pairs of hash functions from U to [to] : 
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Definition 1. Let c > 1 and k > 2. For integers m, £ > 1, and given /i,/2 G 
y.'^, gi,...,gc e y.^, and vectors zj*^ S [mY , 1 < j < c, for i e {1,2}, let 

{hi,h2) = (/ii,/i2)(/i,/2,gi, ■ • . ,gc,4^^ ■ • ■ ;^c^\4^\ ■ • ■ ,^c^^); where 

= + Ei<j<c^i'''[5i(a;)]) mod m, for x eU,ie {1,2}. 

iei be the family of all these pairs {hi, /12) of hash functions. 

While this is not reflected in the notation, we consider (/ii,/i2) as a structure 
from which the components gi, . . . , gc and fi, z[^\ . . . , Zc^\ i S {1,2}, can be 
read off again. It is family Z = zf^^ , for some fc > 1, made into a probability 
space by the uniform distribution, that we will study in the following. We usually 
assume that c and k are fixed and that m and t are known. 

2.1 Basic Facts 

We start with some basic observations concerning the effects of compression 
properties in the "5-part" of (/ii,/i2), extending similar statements in 9 . 

Definition 2. For T Q U , define the random variable dx, the "deficiency" of 
{hi,h2) with respect to T, by dT((/ii,^2)) = |r| - max{fc, |fl'i(r)|, . . . , |5c(7')|}- 
(Note: dr depends only on the gj-components of {hi,h2).) Further, define 

(i) badr as the event that dx > k; 

(ii) goodji as badr, i- c., the event that dx < fc; 

(iii) critr is the event that dx — k. 

Hash function pairs (/ii,/i2) in these events are called "T-bad", "T-good", and 
"T-critical" , resp. 

Lemma 2. Assume k > I and c > 1. For T QU , the following holds: 

(a) Pr(badT U critr) < {\T\^^/ty. 

(b) Conditioned on goodj^ (or on critT), the pairs {hi{x) , h2{x)) , x T, are 
distributed uniformly and independently in [r]^. 

Proof, (a) Assume |T| > 2k (otherwise the events badr and crity cannot occur). 
Since gi,...,gc are independent, it suffices to show that for a function g chosen 
randomly from Uf we have Pr(|r| - \g{T)\ > k) < \T\^^/l^. 

We first argue that if |T| - \g{T)\ > k then there is a subset T' of T with 
\T'\ = 2k and |g(r')| < k. Initialize T' as T. Repeat the following as long as 
jr'j >2k: (i) if there exists a key a; G T such that g{x) ^ g{y) for ah y &T'\{x}, 
remove x from T'; (ii) otherwise, remove any key. Clearly, this process terminates 
with \T'\ — 2k. It also maintains the invariant ~ |5(7")l > k: lu case (i) 
|T'| — |(7(r')l remains unchanged. In case (ii) before the key is removed from T' 
we have \g{T')\ < \T'\/2 and thus |T'| - \g{T')\ > \T'\/2 > k. 

Now fix a subset T' of T of size 2k that satisfies |5(T')| < k. The preimages 
g~^{u), u e g{T'), partition T' into k' classes, k' < k, such that g is constant on 
each class. Since g is chosen from a 2A;-wise independent class, the probability 
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that g is constant on all classes of a given partition of T' into classes Ci , . . . , Ck' , 
with k' < k, is exactly ^-(2^-^') < f-^. 

Finally, we bound Vi{\g{T)\ < \T\ - k). There are i}^^) subsets T' of T of 
size 2fc. Every partition of such a set T' into k' < k classes can be represented 
by a permutation of T' with fc' cycles, where each cycle contains the elements 
from one class. Hence, there are at most (2fc)! such partitions. This yields: 

Pr(|r|-|.9(T)|>fc)<(^l2jj.(2fc)!.^<L^. (1) 

(b) If \T\ < 2k, then hi and /i2 are fully random on T simply because /i and 
/2 are 2A:-wise independent. So suppose |T| > 2k. Fix an arbitrary g-part of 
(/ii,/i2) so that good-r occurs, i.e., max{k,\gi{T)\, . . . ,\gc{T)\} > \T\ — k. Let 
jo G {1, . . . ,c} be such that \gjo{T)\ > \T\ — k. Arbitrarily fix all values in the 
tables zj*^ with j ^ jo and i G {1,2}. Let T* be the set of keys in T colliding with 

other keys in T under gjg. Then |T*| < 2k. Choose the values Zj^J[gjoix)] for all 
X € T* and i G {1, 2} at random. Furthermore, choose /i and /2 at random from 
the 2fc-wise independent family H^'^. This determines hi{x) and h2{x), x G T*, 
as fully random values. Furthermore, the function gj^ maps the keys x £ T — T* 

to distinct entries of the vectors zf^ that were not fixed before. Thus, the hash 
function values hi(x), h2{x), x G T ^ T* , are distributed fully randomly as well 
and are independent of those with x G T*. □ 



3 Graph Properties and Basic Setup 

For TO € N let Qm denote the set of all bipartite (multi-)graphs with vertex set 
[to] on each side of the bipartition. A set A C Q,^ is called a graph property. For 
example, A could be the set of graphs in Qm that have excess larger than s. For 
a graph property A C and T C U, let At denote the event that G{T, hi, /12) 
has property A (i. e., that G{T, hi, /12) G A). In the following, our main objective 
is to bound the probability Pr(3r C S: At) for graph properties A which are 
important for our analysis. 

For the next lemma we need the following definitions. For S Q U and a graph 
property A let B-g C Z be the event 3T C S : ^THbady (see Def. . Considering 
fully random hash functions (/i*, /ij) for a moment, let = Pr(G'(r, /ii, /12) G 
A). 

Lemma 3. For an arbitrary graph property A we have 

Pt{3T C S: At) <Pt{B^)+J2pt- (2) 

TCS 

Proof. Pr(3T C 5 : ^It) < Pr(Bs ) + Pr((3r C 5 : ^It) n 'sf), and 

Pr^T nB^)<J2 n good^) < J2 P^-^T I goodj,) = Pt, 

TCS ''^ TCS TCS TCS 

where (i) holds by the definition of B-g, and (ii) holds by Lemma [2l^b). □ 
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This lemma encapsulates our overall strategy for bounding Pr(3T C S: At)- 
The second summand in ^ can be bounded assuming full randomness. The 
task of bounding the first summand is tackled separately, in Section [?1 

4 A Bound for Leafless Graphs 

The following observation, which is immediate from the definitions, will be help- 
ful in applying Lemma [3] 

Lemma 4. Let m e N, and let AcA'cg,^. Then Pr(B^) < Pi{Bf'). □ 

We define a graph property to be used in the role of A' in applications of LemmaUl 
A node with degree 1 in a graph is called a leaf; an edge incident with a leaf is 
called a leaf edge. An edge is called a cycle edge if removing it does not disconnect 
any two nodes. A graph is called leafless if it has no leaves. Let LL C be the 
set of all leafless graphs. The 2-core of a graph is its (unique) maximum leafless 
subgraph. The purpose of the present section is to prove a bound on Pr(_B^'"). 

Lemma 5. Let e > 0, let S Q U with \S\ — n, and let m = (1 + e)n. Assume 
(^1,^2) is chosen at random from Z = Zf^^ . Then Pr(_Bg'") = 0(n/t'^^^. 

We recall a standard notion from graph theory (already used in |9j; cf. App. lA.l"]) : 
The cyclomatic number 7(G) of a graph G is the smallest number of edges one 
has to remove from G to obtain a graph with no cycles. Also, let C{G) denote 
the number of connected components of G (ignoring isolated points). 

Lemma 6. Let N(t, be the number of non-isomorphic (multi-) graphs 

with C connected components and cyclomatic number 7 that have t edges, I of 
which are leaf edges. Then N{t,e,j,C) = iC>(^+T+?). 

Proof In jl Lemma 2] it is shown that N{t,£,-f, 1) = tO(£+7)^ ^ote that 
each graph G with cyclomatic number 7, C connected components, t — £ non-leaf 
edges, and £ leaf edges can be obtained from some connected graph G' with 
cyclomatic number 7, t — £ + — I non-leaf edges, and £ leaf edges by removing 
C — 1 non-leaf, non-cycle edges. There are no more than {t — £ + ( — ways 
for choosing the edges to be removed. This implies, using [£1 Lemma 2]: 

N{t, £, ^X)<N{t + C-l,t,l,l)-{t-£ + C- ^f-' 

We shall need more auxiliary graph properties: A graph from Q„^ belongs to LCY 
if at most one connected component contains leaves (the leaf component)] for 
K >1 li belongs to LCY'^-* if it has the following four properties: 

1. at most one connected component of G contains leaves (i. e., LCY'^-* C LCY); 

2. the number C(G) of connected components is bounded by K\ 

3. if present, the leaf component of G contains at most K leaf and cycle edges; 

4. the cyclomatic number 7(G) is bounded by K. 
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Lemma 7. If T Q U and {hi,h2) is from Z such that G{T,hi,h2) G LL and 
(^1,^2) is T-had, then there exists a subset T' of T such that G(T' ,hi,h2) G 
l_(~Y(4cfe) (ind{hi,h2) is T' -critical. 

Proof. Fix T and {hi, /12) as in the assumption. Initialize T' as T. We will remove 
("peel") edges from G'(T', /ii, /12) in four stages. Of course, by "removing edge 
h2{x)) from G{T' , /ii, /12)" we mean removing x from T' . 

Stage 1: Initially, we have dT'((^i,^2)) > k. Repeat the following step: If 
G{T' ,hi,h2) contains a leaf, remove a leaf edge from it, otherwise remove a 
cycle edge. Clearly, such steps maintain the property that G{T' , /ii, /12) belongs 
to LCY. Since dr' ((/ii, ^12)) can decrease by at most 1 when an edge is removed, 
we finally reach a situation where (iT'((^i, /12)) = k, i.e., (/ii,/i2) is T'-critical. 
Then G(T', hi, /12) satisfies Property 1 from the definition of LCY^'^'^'^). 

To prepare for the next stages, we define a set T* C T' with 2k < |T*| < 
2ck, capturing keys that have to be "protected" during the following stages to 
maintain criticality of T'. If \T'\ = 2k, we simply let T* = T . Then {hi,h2) 
is r*-critical. If \T'\ > 2k, a little more work is needed. By the definition 
of dT{{hi,h2)) we have \T'\ - max{|5i(T')|, • . • , |gc(r')|} = k. For each j e 
{!,...,€} Lemmallla) gives us a set T* C T' such that \T*\ = 2k and \gj{T*)\ < 
k. Let T* := Tj* U . . . U T*. Clearly, 2k < \T*\ < 2ck. Since T* C T*, we have 
1^1 - \9jiT*)\ > \T*\ - \gjiT*)\ > k, for 1 < j < c, and hence dr- ((/ii, /12)) > k. 
On the other hand we know that there exists some j with |T'| — \gj{T')\ — k. 
Since T* C T', we have |T*| - |gj(T*)| < k for this j. Ahogether we get 
dr* {{hi, /12)) = k, which means that {hi, /12) is T*-critical also in this case. 

Now we "mark" ah edges of G = G{T', hi,h2) whose keys belong to T* . 

Stage 2: Remove all components of G without marked edges. Afterwards 
there are at most 2ck components left, and G satisfies Property 2. 

Stage 3: If G has a leaf component G, repeatedly remove unmarked leaf and 
cycle edges from G, while G has such edges. The remaining leaf and cycle edges 
in G are marked, and thus there number is at most 2ck; Property 3 is satisfied. 

Stage 4: If there is a leaf component G with z marked edges (where z < 2ck), 
then 7(G) < z—1. Now consider a leafless component G' with cyclomatic number 
z. We need the following claim, which is proved in Appendix [Bl 

Claim. Every leafless connected graph with i marked edges has a leafless con- 
nected subgraph with cyclomatic number < i+1 that contains all marked edges. 

This claim gives us a leafless subgraph G" of G' with 7(G") < z + 1 that 
contains all marked edges of G'. We remove from G all vertices and edges of 
G' that are not in G". Doing this for all leafless components yields the final 
key set T' and the final graph G = G{T' , hi, /12). Summing contributions to the 
cyclomatic number of G over all (at most 2ck) connected components, we see 
that 7(G) < 4cfc; Property 4 is satisfied. □ 

What have we achieved? By Lemma [3 we can bound Pr(i?^'-) by just adding, 
over all T' C 5", the probabilities Pr(LCY^,'^'^^ n critT')> that means, the terms 
Pr(LCY^/'^'^^ I crit^') • Pr(critT')- Lemma [2ja) takes care of the second factor. By 
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Lemma IHJb), we may assmne that {hi, ^,2) acts fully random on T' for the first 
factor. The next lemma estimates this factor, using the notation from Section[21 

Lemma 8. Let T CU, \T\ andc,k>l. Then pLCY(*<='=)< ^1 . ^o{l)/^t-l^ 

Proof. By Lemma [51 there are at most t^('^'^') — t'^(^) ways to choose a bipartite 
graph G in LCY^'*'^'^'' with t edges. Graph G cannot have more than t + 1 nodes, 
since cyclic components have at most as many nodes as edges, and in the single 
leaf component, if present, the number of nodes is at most one bigger than the 
number of edges. In each component of G, there are two ways to assign the 
vertices to the two sides of the bipartition. After such an assignment is fixed, 
there are at most m*+^ ways to label the vertices with elements of [m], and 
there are tl ways to label the edges of G with the keys in T. Assume now such 
labels have been chosen for G. Draw t edges {hl{x), h2{x)) from [m]^ uniformly 
at random. The probability that they exactly fit the labeling of nodes and edges 
of G is l/m2*. Thus, pLCY(*='=) < ^t+i . ^, . tO(i) /^2t ^ . ^o(i)/^t-i^ □ 

We can now finally prove Lemma [5l the main lemma of this section. 
Proof (of Lemma\^. By Lemma[71 and using the union bound, we get 

Pr(S^'-) Pr(3r C S- : LLt n badr) < Pr(3r' C S : LCY^t''''^ n critr') 
< Pr(LCY^^,''''^ I critT') • Pr(critT') =: Ps- 

T'CS 

By Lemma [SJb), given the event that {hi,h2) is T'-critical, (/ii,/i2) acts fully 
random on T'. Using Lemma [8] and Lemmata), this yields: 

Pr(LCY^t'''^ I critT') • Pr(critT') < (|r'|! • \T'\^'^^^ /m^'^'^-^) ■ (iT'iyiyK 

Summing up, collecting sets T' of equal size together, and using that ck is con- 
stant, we obtain 

2k<t<n^ ' ^ ' 2k<t<n^ ' 

5 Cuckoo Hashing With a Stash 

In this section we prove the desired bound on the rehash probability of cuckoo 
hashing with a stash when functions from Z are used. We focus on the question 
whether the pair (/ii, /12) allows storing key set S in the two tables with a stash 
of size s. In view of Lemma (TJ we identify minimal graphs with excess s + 1. 

Definition 3. An excess-(s + 1) core graph is a leafless graph G with excess 
exactly s + 1 m which all connected components have at least two cycles. By 
(-g(s+i) denote the set of all excess-{s + 1) core graphs in Qm. 
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Lemma 9. Let G ~ G{S, hi, ^,2) be a cuckoo graph with ex(G') > s + 1. Then 
G contains an excess-{s + 1) core graph as a subgraph. 

Proof. We repeatedly remove edges from G. First we remove cycle edges until the 
excess is exactly s + 1. Then we remove components that are trees or unicyclic. 
Finally we remove leaf edges one by one until the remaining graph is leafless. □ 

We are now ready to state our main theorem. 

Theorem 1. Let e > and < 5 < 1, let s > and k > 1 be given. Assume 
c > (s + 2)/{5k). For n > 1 consider m > (1 + e)n and £ — . Let S Q U 
with \S\ = n. Then for {hi, /12) chosen at random from Z = Z'^'l^ the following 
holds: 

Pr(ex(G(5,/ii,/i2)) >s + l) = 0(1^+1). 

Proof. By Lemma[3]and Lcmma[9l the probability that the excess of G{S, hi, ^,2) 
is at least s + 1 is 

Pr(3r C S: CS^^+^)) < Pr(i?SS'=+^' ) + ^ pCS<=+^)_ (3) 

TCS 

bmce 

Cs(^+i) c LL, we can combine Lemmas |4] and [5] to obtain Pr(_Bo^ ) < 
Pr(_B^'-) = 0{n/l'^^). It remains to bound the second summand in ([3|)0 

Lemma 10. Etcs^P''^" =0(1/71"+^). 

Proof. We start by counting (unlabeled) excess-(s + 1) core graphs with t edges. 
A connected component G of such a graph G with cyclomatic number 7(C) 
(which is at least 2) contributes 7(C) — 1 to the excess of G. This means that if 
G has C = C(G) components, then s + 1 = 7(G) — ^ and C !i * + li and hence 
7 = 7(G) < 2(s + l). Using Lemmad there are at most iV(t,0,7,C) = = 
fO{s) g^pj^ graphs G. If from each component G of such a graph G we remove 
7(G) — 1 cycle edges, we get unicyclic components, which have as many nodes 
as edges. This implies that G has t — (s + 1) nodes. 

Now fix a bipartite (unlabeled) excess-(s + 1) core graph G with t edges and 
C components, and let T C L/ with |T| — the given. There are 2'= < 2*+-'^ ways 
of assigning the t — s — 1 nodes to the two sides of the bipartition, and then at 
most m*~'*~^ ways of assigning labels from [m] to the nodes. Thus, the number 
of bipartite graphs with property CS'-'*^^-', where each node is labeled with one 
side of the bipartition and an element of [m] , and where the t edges are labeled 
with distinct elements of T is smaller than t\ ■ 2^^^^ ■ m*~^~^ ■ t'~'^'^\ 

Now if G with such a labeling is fixed, and we choose t edges from [m]^ 
uniformly at random, the probability that all edges {hi{x), h2{x)), x € T, match 

* We remark that the following calculations also give an alternative, simpler proof 
of [111 Theorem 2.1] for the fully random case, even if the effort needed to prove 
Lemma |6] and [H Lemma 2] is taken into account. 
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the labeling is 1/m . For constant s, this yields the following bound: 

TCS s+3<t<n ^ ' s+3<t<n 



-V y - 



' s+3<t<n ^ ^ 

Since 1 = and c > (s + 2)/(fc(5), we get 

Pr(ex(G') > s + 1) = ©(n/r*^) + ©(l/n^+i) = 0(l/n'*+i). □ 

6 Simulating Uniform Hashing 

In the following, let R be the range of the hash function to construct, and assume 
that (i?, ®) is a commutative group. (We could use R = \t\ with addition mod 

Theorem 2. Let n > 1, < (5 < 1, e > 0, and s > be given. There exists a 
data structure DS„ that allows us to compute a function h: U ^ R such that: 

(i) For each S C. U of size n there is an event Bs of probability 0{l/n'^^^) 
such that conditioned on Bs the function h is distributed uniformly on S . 

(ii) For arbitrary x d U , h{x) can be evaluated in time 0{s/5). 

(iii) DSn comprises 2(1 + e)n + 0{sn^) words from R and 0{s) words from U . 

Proof. Let k >1 and choose c > (s + 2)/{k5). Given U and n, set up DS„ as 
follows. Let ni = (1 + e)n and i = n'', and choose and store a hash function pair 
{hi, /12) from Z = zf^^ (see Definition [1]) , with component functions gi, . . . ,gc 
from H'j''. In addition, choose 2 random vectors ti,t2 & R^,c random vectors 
VIt ■ ■ tUc € ^ and choose / at random from a 2A;-wise independent family of 
hash functions from U to R. 

Using DS„, the mapping /i: [/ — > i? is defined as follows: 

h(x) = ti[hi{x)] t2[h2{x)] © f{x) vi[gi{x)] © ... © Vc[9c{x)]. 

DS„ satisfies (ii) and (iii) of Theorem [51 We show that it satisfies (i) as well. 

First, consider only the hash functions {hi, /12) from Z. By Lemma[S]we have 
Pr(SLL) ^ 0{n/e'^) = 0(l/n''+i). Now fix {hi, /la) i B^!-, which includes fixing 
the components gi, . . . , gc. Let T C S* be such that G{T, hi, /12) is the 2-core of 
G{S, hi, /12), the maximal subgraph with minimum degree 2. Graph G{T, hi, /12) 
is leafless, and since (/ii,/i2) ^ Bg^, we have that {hi,h2) is T-good. Now we 
note that the part f{x) ffi ®i<j<c 2/i[5j(2;)] of h{x) acts exactly as one of our 
hash functions hi and /12 (see Definition [IJa)), so that arguing as in the proof 
of Lemma [2] we see that h{x) is fully random on T. 

Now assume that / and the entries in the tables yi, . . . ,yc are fixed. It is not 
hard to show that the random entries in ti and ^2 alone make sure that h{x), 
x £ S ~ T, is fully random. (Such proofs were given in [9] and [16].) □ 
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Concluding Remarks 

We presented a family of efficient hash functions and showed that it exhibits 
sufficiently strong random properties to run cuckoo hashing with a stash, pre- 
serving the favorable performance guarantees of this hashing scheme. We also 
described a simple construction for simulating uniform hashing. We remark that 
the performance of our construction can be improved by using 2-universal hash 
familie^ (see, e.g., |2I5| ) for the pj-components. The proof of Lemma [5] can be 
adapted easily to these weaker families. It remains open whether generalized 
cuckoo hashing [1018] can be run with efficient hash families. 
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A Excess, Stash Size, and Insertions 

In this supplementary section, provided for the convenience of the reader, we 
clarify the connection between stash size needed and the excess ex{G{S, hi, /i2)) 
of the cuckoo graph G{S,hi,h2) as well as the role of insertion procedures. In 
particular, we prove Lemma [T] The central statements of this section can also 
be found in [HTM] . 

A.l The Excess of a Graph 

For G a graph, ((G) denotes the number of connected components of G. The 
cyclomatic number 7(G), technically defined as "the dimension of the cycle space 
of G" , can be characterized by the following basic formula |3] : 

j{G)^m~n + C{G), (4) 

for n the number of nodes and m the number of edges of G. Note that acyclic 
graphs are characterized by the equation n = m+({G) and hence by the equation 
7(G) — 0. Using (U), two helpful ways of viewing 7(G) are easy to prove. 

Lemma 11. (a) // we remove edges from G sequentially, in an arbitrary order, 
and the resulting graph is acyclic, then 7(G) is the number of cycle edges 
removed. 

(b) 7(G) is the minimum number of edges one has to remove from G such that 
the resulting graph is acyclic. 

Proof. Assume a subgraph G' of G (with all n nodes) has m' > edges. If we 
remove one edge e' from G' to obtain G", we have, using ^ twice: 

7(G") = (m' ~l)-n + C(G") = 7(G') - (1 - (C(G") - C(G'))). 

We observe: 
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- If e' is a cycle edge in G", then C(G"') = C(G'), and hence 7(6"') = j{G') - 1. 

- If e' is not a cycle edge, then C(G") = C(G') + 1, and hence 7(6") = 7(G'). 



We prove (a): By what we just observed, to reduce the cyclomatic number from 
7(G) to the number of rounds in which a cycle edge is removed must be 7(G). 
Now we prove (b): Think of the edges as being removed sequentially. Again, by 
our observation, in order to reduce the cyclomatic number from 7(G) to by 
removing as few edges as possible we should never remove an edge that is not 
on a cycle. In this way we remove exactly 7(G) (cycle) edges. □ 

We have defined the excess ex(G) of a graph G as the minimum number of edges 
one has to remove from G so that the remaining subgraph has only acyclic and 
unicyclic components. In |14) the characterization of this quantity given next 
was used as a definition; the same idea was used in [T^] (without giving it a 
name) . 

For G a graph, let Ccyc(G) denote the number of cyclic components of G. 
Lemma 12. In all graphs G the equation eyi{G) = 7(G) — Ccyc(G) is satisfied. 
Proof. Assume G has n nodes and m edges. 

"<": Starting with G, we iteratively remove cycle edges until each cyclic com- 
ponent has only one cycle left. The number of edges removed is at least ex(G). 
Call the resulting graph G'. Removing one cycle edge from each of the Ccyc(G) 
cyclic components of G' will yield an acyclic graph. Lemma [TTTa) tells us that 
together exactly 7(G) edges have been removed; hence 7(G) > ex(G) + Ccyc(G). 
">" : Choose a set £'+ of ex(G) edges in G such that removing these edges leaves 
a graph G' with only acyclic and unicyclic components. Now imagine that the 
edges in are removed one by one in an arbitrary order. Let /3 denote the 
number of edges in £'+ that are on a cycle when removed; the other ex(G) — jS 
many were non-cycle edges when removed. Removing one cycle edge from each 
cyclic component of G' will leave an acyclic graph. Counting the number of 
cycle edges we removed altogether, and applying Lemma IllT a) again, we see 
that 7(G) = (i -\- Ccyc(G"). Since removing a non-cycle edge from a graph can 
increase the number of cyclic components by at most 1, we have that Ccyc(G") < 
Ccyc(G)-f (ex(G) — /3). Combining the inequalities yields 7(G) < Ccyc(G) +ex(G). 

□ 

A. 2 The Excess of the Cuckoo Graph and the Stash Size 

The purpose of this section is to prove Lemmall] which we recall here. We assume 
that hi and /12 are given, and write G{S) for G{S, /ii, ^12), for S C U. 

Lemma 1 ( |12| ) . The keys from S can be stored in the two tables and a stash 
of size s using (/ii, ^,2) */ cind only if ex(G(S')) < s. 

Proof. : Assume T is a subset of S of size at most s such that all keys from 
S' = S — T can be stored in the two tables. Then all components of G{S') must 
be acyclic or unicyclic. (Assume G is a component with 7(G) > 1. Then by (|4]) 
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the number of edges (keys) in C would be strictly larger than the number of 
nodes (table positions), which is impossible.) Since G{S') is obtained from G{S) 
by removing the edges {hi{x), h2{x)), x € T, we get ex{G{S)) < s. 
"<^=": Assume ex{G{S)) < s. Choose a subset T of S* of size ex{G{S)) such that 
G{S — T) has only acyclic and unicyclic components. From what is known about 
the behaviour of standard cuckoo hashing, we can store S" = S' — T in the 
two tables using hi and /12 (e.g., see ^3, Sect. 4]). (This can even be proved 
directly. If one of the nodes touched by an edge (ft.i(x), /i2(x)), x E S' , has 
degree 1, we place x in the corresponding cell. Iterating this, we can place all 
keys excepting those that belong to cycle edges. Since G{S') has only acyclic and 
unicyclic components, the cycle edges form isolated simple cycles, and clearly the 
keys that belong to such a cycle can be placed in the corresponding cells.) By 
assumption, the keys from T fit into the stash. □ 

A. 3 The Insertion Procedure 

We consider here the obvious generalization of the insertion procedure in stan- 
dard cuckoo hashing [17] . It assumes that a procedure rehash is given that will 
choose two new hash functions and insert all keys anew. The parameter maxloop 
is used for avoiding infinite loops. (When using cuckoo hashing with a stash of 
size s, one will choose maxloop — 0((s + 2) logn). For analysis purposes, larger 
values of maxloop are considered as well.) Empty table cells contain nil. The 
operation swap exchanges the contents of two variables. 

Algorithm 1 (Insertion in a cuckoo table with a stash). 

procedure stashlnsert{x: key) 
(1) nestless :— x; 



As long as it is not finished, the procedure maintains a "nestless" key (in 
nestless) and the current index i g {1, 2} (in i) of the table where this key is 
to be placed. When a new key x is to be inserted, it is declared "nestless" and i 
is set to 1. As long as there is a nestless key x, but at most for maxloop rounds, 
the following is iterated: Assume x is nestless and the current index is i. Then 
X is placed in position hi(x) in table Ti. If this position is empty, the procedure 
terminates; if it contains a key x' , that key gets evicted to make room for x, is 
declared nestless, and i is changed to the other value 3 — z. If the loop does not 
terminate within maxloop rounds, the key that is currently nestless gets stored 
in the stash. If this causes the stash to overflow, a rehash is carried out. (This 



(2) 
(3) 
(4) 
(5) 
(6) 
(7) 
(8) 
(9) 



repeat maxloop times 

swap(nestless, T± [hi (nestless)]) ; 
if nestless = nil then return; 

i := 3 — i; 



if stash is not yet full 

then add nestless to stash 
else rehash. 



i:=l; 
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may be realized by collecting all keys from tables and stash as well as the nest- 
less key, choosing a new pair {hi, h2) of hash functions, and calling the insertion 
procedure for all keys.) 

A. 4 Complete Insertion Loops and the Excess 

We first look at the behavior of certain variants of the insertion procedure (called 
"complete" ) , which exhibit the following behavior when x is inserted: (i) if with 
maxloop set to infinity the loop were to run forever, then this is noticed and at 
some point the currently nestless key is put in the stash; (ii) otherwise the loop 
is left to run until the nestless key is stored in an empty cell. It is not hard to 
see (c/. [3 ) that one obtains a complete variant from Algorithm [T] if one chooses 
maxloop as some number larger than 2|5| + 3. 

Proposition 1 ( jl2lll4p . If inserting the keys of S by some complete insertion 
procedure places s keys in the stash, then s — ex(G(S')) = ex(G(S', hi, /i2))- 

Proof. ">": After the insertion is complete, all keys from S are stored in the 
two tables and the stash. Lemma [T] implies that s > ex{G{S)). 
"<": For this, we use induction on the size of S*. If 5* = 0, excess and stash size 
are both 0. Now assume as induction hypothesis that set S has been inserted, 
that the set of keys placed in the stash is T, and that \T\ — s < ex{G{S)). Let 
S' = S — T. We insert a new key y from U — S. 

Case 1: The insertion procedure finds that y can be accommodated without 
using the stash. — The stash size remains s, and s < ex{G{S)) < ex(G(5 U {y})). 
Case 2: The complete insertion procedure notices that the loop were to run 
forever and places some key in the stash. — By the properties of the complete 
insertion loop for standard cuckoo hashing as explored in [3] we know that G(S"U 
{y}) must contain a connected component that is neither acyclic nor unicyclic. 
Since ex(G(S")) = 0, it must be edge {hi{x) , h2{x)) that makes the difference. 
This means that each endpoint of {hi{x), h2{x)) lies in some cyclic component of 
ex(G(S")). Now G(S") is a subgraph of G(S'), so the same is true in G{S). Recall 
Lemma 1121 and consider two cases when changing from S* to S* U {y}: If the 
endpoints of {hi{x) , h2{x)) lie in two different cyclic components of G(S'), then 
the number of cyclic components decreases by 1, hence the excess increases by 
1; if they lie in one and the same cyclic component, then the cyclomatic number 
increases by 1, and the excess increases by 1 as well. In both cases we get that 
s + 1 < ex(G(S')) + 1 =ex(G(S'U{y})). □ 

A. 5 Standard Insertion 

It turns out that by choosing maxloop = Q{{s + 2) logn) in Algorithm [T] we can 
make sure that with probability of 0(1/71"+^) no rehash is necessary|f| Note that 

® If deletions are allowed, before calling rehash, one should try whether any one of the 
s keys presently stored in the stash can be inserted into the tables by the insertion 
procedure. We ignore deletions here. 
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if the stash has size 0, then Algorithm [T] is exactly the insertion procedure of 
standard cuckoo hashing from [IT] • The following claim and proof are similar to 
what has to be done in the analysis of standard cuckoo hashing. 

Proposition 2. Assume the hash functions (/ii,/i2) '^'"^ Z*^^^?/ random, and the 
keys from S are inserted sequentially into a cuckoo table with a stash of size s, 
using Algorithm]^ If we choose maxloop — a{s + 2) logrt for a suitable constant 
a > 0, then we have: 

Pr(thc stash of size s overflows) = 0{l/n'''^^). 

Sketch of proof. Theorem [T] tells us that the probability that a stash of size s 
is not sufficient because the excess of G{S, h^, ^,2) is too large is 0(l/n''+^). All 
we have to show is that the probability is also this small that an extra key slips 
into the stash because the insertion loop was stopped by the step counter hitting 
maxloop. Let S = {xi, . . . , x„}, with the keys listed in the order in which they are 
inserted, and let 5^ = {xi, . . . , Xj}. For 1 < j < n and some bound p consider the 
event that the insertion procedure for Xj needs p or more rounds. One can show 
(this was done in jl7] with a different terminology) that then G{Sj) must contain 
a path Mo, ui, . . . ,ut, ut+i, with t = [p/S] , where uq is the node corresponding 
to Ti[hi{xj)], for i ^ 1 OT i — 2, and uq, ■ . ■ ,ut are distinct nodes. Viewing the 
situation in terms of edges this means that there must be some T C 5^-1 of size 
t = \p/3] such that the edges (/ii(x), /i2(a;)), with x G T, in some order, form 
such a path. The latter event we call At- We have Pi-{At) < tl ■ 2/m*. The 
number of sets T to consider is ("'7^) < (")• Thus, 

Pr(aTCV,:|T|=.A^.)<0t!.A<_l_. (5) 

If the insertion of Xj increases the stash size although ex{G(Sj)) = ex(G(S'j_i)), 
then this insertion must make p = maxloop steps. By ([5]), the probability of 
this to happen is smaller than 2/(1 + r™a3:Zoop/3l ^ choose maxloop = 

3(s+2) logi_|_g n (i. e., a = 3/ log(H-e) = 9(I/e)), this probability will be smaller 
than I/n*"*"^. Summing over all j we obtain the bound 0(I/?i'*+^). □ 

Proposition 3. Assume the hash functions {hl,h2) are fully random, the keys 
from S are stored in a cuckoo table with a stash of size s, and a new key y is 
inserted by Algorithm]^ with maxloop > a{s + 2) logn for a as in Proposition\^ 
Then the expected number of steps needed for this insertion is 0(1). 

Sketch of proof. Let the random variable Z denote the number of rounds needed 
for this insertion. We ignore the cost of a rehash. (The contribution of this rare 
event to the overall insertion time is 0{l/n''). A discussion of the case s = can 
be found in [9].) Then E(Z) < J2p>i Pr(at least p rounds are needed to store y), 
and hence, using lU and arguing as in [TT] . 

E(Z) < ^Pr(3T: |r| = {p^ A At) < ^ , ,Up/31 = ^W- □ 
p>i p>i ^ ^ 
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Of course, the last two propositions are formulated for fully random hash func- 
tions. Using the techniques developed for the proof of Theorem [1] one can show 
that they are valid for hash functions from Zf^^ as well, for the parameter 
choices as in that theorem. The only difference is that instead of the graph prop- 
erty LL one has to use the graph property "connected" in a way explored in 
detail in j9]. 

B Proof of a Claim 

We prove the following claim, stated and used in the proof of Lemma [T] 

Claim. Every leafless connected graph with i marked edges has a leafless con- 
nected subgraph with cyclomatic number < that contains all marked edges. 

Proof. Let G — {V^E) be a leafless connected graph. If ^{G) < i -|- 1, there is 
nothing to prove. Thus assume 7(G) > i + 2. Choose an arbitrary spanning tree 
{V,E^) of G. 

There are two types of edges in G: bridge edges and cycle edges. A bridge 
edge is an edge whose deletion disconnects the graph, cycle edges are those whose 
deletion does not disconnect the graph. 

Clearly, all bridge edges are in Eq . Let £',„b C Eq denote the set of marked 
bridge edges. Removing the edges of £^mb from G will split V into |£'mb| + 1 
connected components Vi, . . . ,V\e^^^\+i] removing the edges of E^mb from the 
spanning tree {V, Eq) will give exactly the same components. For each cyclic 
component Vj we choose one edge ej ^ Eq that connects two nodes in Vj. The 
set of these |-Emb| + 1 edges is called Ei. Now each marked bridge edge lies on a 
path connecting two cycles in {V,EoL}Ei). 

Recall from graph theory [4] the notion of a fundamental cycle: Clearly, each 
edge e £ E — Eo closes a unique cycle with E^. The cycles thus obtained are 
called the fundamental cycles of G w. r. t. the spanning tree (V, Eq). Each cycle 
in G can be obtained as an XOR-combination of fundamental cycles. (This is 
just another formulation of the standard fact that the fundamental cycles form 
a basis of the "cycle space" of G, see |4].) From this it is immediate that every 
cycle edge of G lies on some fundamental cycle. Now we associate an edge e' ^ Eg 
with each marked cycle edge e £ -Emc- Given e, let e' ^ Eq be such that e is on 
the fundamental cycle of e'. Let E2 be the set of all edges e' chosen in this way. 
Clearly, each e G Emc is a cycle edge in {V, EqU E2). 

Now let G' = {V,Eo\JEi\JE2). Note that \E1\JE2\ < (|E,„b| + l) + |En,c| < i+l 
and thus 7(G') < i -I- 1. In G', each marked edge is on a cycle or on a path that 
connects two cycles. If we iteratively remove leaf edges from G' until no leaf is 
left, none of the marked edges will be affected. In this way we obtain the desired 
leafless subgraph G* with 7(G*) = 7(G') <i + l. □ 
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